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DETAILED ACTION 

1 . This action is in response to the amendment filed on 1 1/23/2007. 
Claims 1-15, 20-36 are pending in the application. 

Response to Arguments 



2. In view of the Applicants' amendment/remarks, filed on 1 1/03/07: It appears that Applicants 
traverse the obviousness and argue that, 

Microsoft does not disclose receiving application and system information from one or more 
inoculation clients installed on the devices, said receiving performed via peer-to-peer 
communication. 

In response to Applicants' argument that the examiner's conclusion of obviousness is based upon 
improper hindsight reasoning, it must be recognized that any judgment on obviousness is in a sense 
necessarily a reconstruction based upon hindsight reasoning. But so long as it takes into account only 
knowledge which was within the level of ordinary skill at the time the claimed invention was made, and 
does not include knowledge gleaned only from the applicant's disclosure, such a reconstruction is proper. 
See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 1971). 

In response to Applicants argument that Microsoft does not disclose receiving... It is unclear what 
point in this argument, whether the argument is that Microsoft does not teach receiving 
application/information from the clients or Microsoft does not teach peer-to-peer. Applicants' argument 
does not directly to the main functionality of the claims, but is off from the heart of the specification. It 
should be note that the heart of the specification is to disclose patch management as Microsoft does. It 
should be noted that Internet provides two-way communication, where a clients within Microsoft can 
transparently use the Microsoft websites, as shown in p. 6 and p. 7, and p. 14, for providing the 
information. In p. 7, "Windows Update", it is for a client who communicates with its server for receiving 
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patch update. With a baseline security Analyzer, it allows users to scan (queue) one or more Windows- 
based computers for common security misconfigurations (p. 7-8). This is two-way communications. On 
the other hand, a peer-to-peer system according to the Microsoft dictionary is only a network of two or 
more computers that use the same program or type of program to communicate and share the data. Each 
computer acts like a server to other in the network. Thus, the inclusion of the peer-to-peer in a claim does 
not make it distinct from a pair of server/client computers, or a cluster of computers communicated in an 
organization like of Microsoft. Therefore, Microsoft discloses the claimed limitation above. 

With regard to the Applicants arguing the GET and POST commands. It should be noted that 
GET/ADD/DELETE/POST commands are public use and standardized for sending request and response 
between two computers connected in a network via Browser using HTTP protocol. Microsoft users use 
this standard protocol. 

See this standard POST and GET commands in The Network Working Group which defines the 
specification to address these standard commands for network communication. It is improper to address 
common and standard features used in publics as a claimed feature, where with own. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for ail obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as 
set forth in section 102 of this title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole would have been obvious 
at the time the invention was made to a person having ordinary skill in the art to which said 
subject matter pertains. Patentability shall not be negatived by the manner in which the invention 
was made. 
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4. Claims 1-15, 20-36 are rejected under 35 U.S.C. 103(a) as being unpatentable over Microsoft 
White Paper, "Understanding Patch and Update Management: Microsoft's Software Update Strategy", 
Microsoft Corporation, pages: i-iii, 1-14, October 2003. 

Given the broadest reasonable interpretation of followed claims in light of the specification. 
As per Claim 1 : Microsoft discloses, 

A method for automatically distributing a software update to a network of devices controlled by an 
organization, the method comprising: 

receiving application and system information from one or more inoculation clients installed on the 
devices, said receiving performed via peer-to-peer communication; (See the whole reference, 
particularly, Microsoft provides tools to a client within a small Organizations (p.7), Medium-Sized 
Organizations (p. 9), Large Organizations (p. 11), etc., these organizations are inoculation client 
application and system information peer-to-peer receiver); 

comparing said application and system information with application and version information in a 
global update repository to determine if an update exists for a corresponding application 
controlled by an inoculation client, the global update repository including updates from multiple 
application manufacturers; 

(For example, see, p. 7, p. 10, Microsoft Baseline Security Analyzer supports security update that has 
means for comparing application and system information with the application and version information in 
an update repository. The analyzer supports for performing the security updates portion of a scan. Also 
see p 11, Microsoft Download website ('update repository 1 ). See p. 13, "Microsoft Update", scheduled for 
release in Spring 2004, will consolidate the patchs and updates into one repository ('update repository'). 
At launch, Microsoft Update will support patches, updates, and service packs for Windows 2000, XP, 
Server 2000 & 2003 operating systems as well as Microsoft Office 2003, Microsoft SQL Server 2000, and 
Microsoft Exchange Server 2003); 
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queueing the update if an update exists for an application controlled by an inoculation client; 
receiving a communication from the corresponding inoculation client checking for available 
distribution jobs; 

(For example, the baseline security Analyzer allows users to scan (queue) one or more Windows-based 
computers for common security misconfigurations (p. 7-8) (i.e. has means for checking for available 
distribution jobs - also has means for comparing said application and system information), Security 
Update Inventory Tool provides ongoing scans of client computers for installed or applicable security 
updates (p. 11), Microsoft Baseline Security Analyzer 2.0 provides a true enterprise-ready scanning 
technology (p. 1 3). See content within Microsoft Baseline Security Analyzer 2.0 (p.1 3)); and 

automatically transmitting the update to the corresponding inoculation client in response to the 
receiving a communication if an update exists for an application controlled by the corresponding 
inoculation client (For example, see Distribute Software Updates Wizard Installer (p. 11-12) and see 
Office Update Inventory Tool). 

Microsoft does not explicitly mention GLOBAL UPDATE REPOSITORY, but its website Microsoft 
Download website ('update repository') and in p. 13, "Microsoft Update", it mentions a future consolidation 
of a centralized update database. 

Thus, it is obvious to the ordinarily in the art that, GLOBAL UPDATE REPOSITORY is only business 
manner complying the law or. business license. It conforms to business agreements rather than an 
invention feature. For example, in p. 13, Microsoft clearly addresses that it can provide centralized 
server, and thus with a centralized server it can provide and update patching globally. 

As per Claim 2 : Microsoft discloses, The method of claim 1, further comprising: configuring an 
inoculation server distributed across one or more of the devices; and performing an initial 
connection between the inoculation server and the global update repository (For example, see P. 6: 
the AutoUpdate feature can be configured to retrieve patches directly from Windows Update at regular 
intervals. Individuals can choose whether to be prompted to install new updates or have them install 
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automatically. See p. 9-10: Clients are configured to connect to specific servers and can be configured for 
automatic software update installations or end-user prompting). 

As per Claim 3 : Microsoft discloses, The method of claim 1, wherein the application and system 
information includes operating system information and version (See content within Microsoft Update (p. 
13)). 

i 

As per Claim 4 : Microsoft discloses, The method of claim 1, wherein the application and system 

! ■ 

j information includes installed software applications and versions (See Software Updates Installation 

I 

Agent(p.12)). 

As per Claim 5 : Microsoft discloses, The method of claim 1, wherein the application and system 
information includes network information (For example, see Virus Information Alliance, p. 5). 

As per Claim 6 : Microsoft discloses, The method of claim 1, wherein the application and system 
information is received in Extensible Markup Language (XML) format (See Office Update Inventory Tool 
(P. 11)). 

| As per Claim 7 : Microsoft discloses, The method of claim 1, wherein the queuing the update includes 

| linking the update package and the corresponding application in a database table (For example, see 

Software Update Services Feature Pack, p. 1 1). 

As per Claim 8 : Microsoft discloses, The method of claim 1, wherein the global update repository is a 

i 

centralized repository that manages operating systems and software to be delivered to inoculation 
servers, (i.e. Microsoft downloads Web site; or see "consolidate the patchs and updates into one 
repository" (p. 13)). 

As per Claim 9 : Microsoft discloses, The method of claim 8, therein the global update repository mines, 
retrieves, and archives external update information (i.e. Microsoft/Microsoft downloads Web site; or see 
"consolidate the patchs and updates into one repository" (p. 13)). 
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As per Claim 10 : Microsoft discloses, The method of claim 9, wherein the external update information is 
mined and retrieved from external security websites (i.e. Microsoft/Microsoft downloads Web site; or see 
"consolidate the patchs and updates into one repository" (p. 13)). 

As per Claim 11 : Microsoft discloses, The method of claim 10, wherein the global update repository uses 
web spiders (i.e. Microsoft/Microsoft downloads Web site; or see "consolidate the patchs and updates into 
one repository" (p. 13)). 

As per Claim 12 : Microsoft discloses, The method of claim 1, wherein the comparing includes utilizing an 
HTTP GET or POST command. (The commands are standard used by HTTP protocol. Functional 
equivalence: "command line operations for scanning one or more Windows-based computers" (p. 8); 
"MBSA Ul or in the MBSA command line interface, seen in p. 7") 

As per Claim 13 : Microsoft discloses, The method of claim 9, wherein the external update information 
contains a vendor type, the vendor type being automatic download and release, automatic download and 
manually confirm release, or manually download and confirm (See section Software Update Service 2.0, 
p. 13). 

As per Claim 14 : Microsoft discloses, The method of claim 1, wherein the comparing is performed by an 
inventory control engine (e.g. Security Update Inventory Tool, p. 11). 

As per Claim 15 : Microsoft discloses, The method of claim 1, wherein the queuing is performed by a 
distribution engine (e.g. Distribute Software Updates Wizard, p. 12). 

As per Claim 20 : Microsoft discloses claim 20. See rationale in addressed in Claim 1. 

As per Claim 21 : Microsoft discloses, 77?e apparatus of claim 20, further comprising: means for 
configuring an inoculation server distributed across one or more of the devices; and means for performing 
an initial connection between the inoculation server and the global update repository. 

See rationale in addressed in Claim 2. 
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As per Claim 22 : Microsoft discloses, The apparatus of claim 20, wherein the application and system 
information includes operating system information and version. See rationale in addressed in Claim 3. 

As per Claim 23 : Microsoft discloses, The apparatus of claim 20, wherein the application and system 
information includes installed software applications and versions. See rationale in addressed in Claim 4. 

As per Claim 24 : Microsoft discloses, The apparatus of claim 20, wherein the application and system 
information includes network information. See rationale in addressed in Claim 5. 

As per Claim 25 : Microsoft discloses, The apparatus of claim 20, wherein the application and system 
information is received in Extensible Markup Language (XML) format 

See rationale in addressed in Claim 6. 

As per Claim 26 : Microsoft discloses, The apparatus of claim 20, wherein the queuing the update includes 
linking the update package and the corresponding application in a database table. See rationale in 
addressed in Claim 7. 

As per Claim 27 : Microsoft discloses, 77?e apparatus of claim 20, wherein the global update repository is a 
centralized repository that manages operating systems and software to be delivered to inoculation 
servers. See rationale in addressed in Claim 8. 

As per Claim 28 : Microsoft discloses, The apparatus of claim 20, therein the global update repository 
mines, retrieves, and archives external update information. See rationale in addressed in Claim 9. 

As per Claim 29 : Microsoft discloses, The apparatus of claim 28, wherein the external update information 
is mined and retrieved from external security websites. 

See rationale in addressed in Claim 10. 

As per Claim 30 : Microsoft discloses, The apparatus of claim 29, wherein the global update repository 
uses web spiders. See rationale in addressed in Claim 1 1 . 

As per Claim 31 : Microsoft discloses, The apparatus of claim 20, wherein the means for comparing 
includes means for utilizing an HTTP GET or POST command. See rationale in addressed in Claim 12. 
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As per Claim 32 : Microsoft discloses, The apparatus of claim 28, wherein the external update information 
contains a vendor type, the vendor type being automatic download and release, automatic download and 
manually confirm release, or manually download and confirm. See rationale in addressed in Claim 13. 

As per Claim 33 : Microsoft discloses, The apparatus of claim 20, wherein the means for comparing is an 
inventory control engine. See rationale in addressed in Claim 14. 

As per Claim 34 : Microsoft discloses, The apparatus of claim 20, wherein the means for queuing is a 
distribution engine. See rationale in addressed in Claim 15. 

As per Claim 35 : Microsoft discloses claim 35. See rationale in addressed in Claim 1. 
As per Claim 36 : Microsoft discloses claim 36. See rationale in addressed in Claim 1. 

Conclusion 

5. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth 
in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date 
of this final action and the advisory action is not mailed until after the end of the THREE-MONTH 
shortened statutory period, then the shortened statutory period will expire on the date the advisory action 
is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the examiner should 
be directed to Ted T. Vo whose telephone number is (571) 272-3706. The examiner can normally be 
reached on 8:00AM to 4:30PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Wei 
Y. Zhen can be reached on (571) 272-3708. 

The facsimile number for the organization where this application or proceeding is assigned is the 
Central Facsimile number 571 -273-8300. 

Any inquiry of a general nature or relating to the status of this application should be directed to 
the TC 2100 Group receptionist: 571-272-2100. Information regarding the status of an application may 
be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. Status information for 
unpublished applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-21 7-91 97 (toll-free). 



TTV 

February 01, 2008 
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